Indian Government Agency Rolls Out HDD, SSD Reuse with Verified Secure Data Erasure

To replace its former practice of physically destroying hard drives to protect sensitive data, a security-critical Indian government agency implemented secure erasure as its sanitization method of choice for used HDDs and SSDs. The revised procedure enables sanitized storage devices to be redeployed, improving both financial and environmental sustainability. Robust audit and regulatory compliance are ensured by tamper-proof reporting and certification of each erasure.

Highlights

Using Blancco data erasure solutions, the agency has:

• Enabled safe, certified HDD and SSD reuse as an alternative to government hard drive destruction
• Verified, through a third-party vendor, that data is unrecoverable after secure erasure
• Fulfilled the governmental requirement for procuring an STQC-certified solution
• Adopted premium local support in Delhi through Blancco’s partner network

Challenge

Like many government entities all over the world, the agency followed a strict policy of physically destroying drives as its only method of sanitizing them. Unfortunately, this approach has financial shortcomings because it prevents drive reuse, forcing the agency to sacrifice their remaining asset value. It also has environmental shortcomings, with shredded drive components ending up as e-waste in landfills. The agency wanted to overcome these limitations using a secure erasure solution that would allow HDDs and SSDs from laptops to be reused instead of destroyed.

Before the agency could confidently redeploy its used laptops, it needed to ensure that previously stored drive data was beyond recovery. That required being able to produce empirical proof of data removal and fulfilling the government requirement to use a solution certified by the Standardisation Testing and Quality Certification (STQC) Directorate, an office of the Indian Ministry of Electronics and Information Technology. In addition, the agency’s headquarters in Delhi required the solution to provide local technical support.

Solution

After a thorough vetting process, the agency chose Blancco Drive Eraser as its secure erasure solution. Blancco Drive Eraser provides a single tool for secure erasure and verification of all data storage drives, such as HDDs, SSDs (including NVMe and PCIe), self-encrypting drives (TCG Opal), drives in Apple machines with T2 security chips, and more, thereby minimizing government hard drive destruction. Blancco’s patented SSD erasure method ensures that all data on SSDs is destroyed beyond recoverability. Critically, the solution also provided tamper-proof certification for audit purposes.

To verify that the solution rendered data completely unrecoverable, the agency contracted with a specialty data forensics provider, delivering test drives that had been securely erased with Blancco Drive Eraser. The vendor applied a rigorous battery of techniques in an unsuccessful attempt to retrieve the erased data; it concluded that the data had been completely eradicated and could not practically be recovered.

Government agencies in India also require that vendor solutions be “STQC certified”—or recognized by the country’s Standardisation Testing and Quality Certification (STQC) Directorate. Blancco Drive Eraser met this requirement, too: Operated by the STQC, the Indian Common Criteria Certification Scheme (IC3S) is recognized by the Common Criteria Recognition Arrangement (CCRA), an association of more than 30 member countries.

Because all members recognize certifications from any CCRA authorizing member, Blancco Drive Eraser’s Common Criteria certification, awarded by the Australasian Certification Authority in 2020, met this requirement. Common Criteria’s rigorous security testing and certification can therefore provide confidence for deployments within other Indian government agencies—just as it has for government organizations (including defense entities) all over the world.

In addition to software and support, the Blancco solution implements offline secure erasure using a HASP key. This physical dongle, which connects directly to a laptop or desktop, prevents the need for the agency to access resources from a cloud or other external network, or even to deploy an application on their own on-premise servers.

Blancco also provided local support through its network of qualified partners, meeting another key stipulation of the project.

Results

With Blancco Drive Eraser in place, the agency can confidently redeploy drives that would otherwise, until recently, have been destroyed. This capability avoids the cost of replacing those drives while mitigating threats associated with unintentional data exposure. It also helps reduce the amount of e-waste that reaches landfills in the form of shredded storage media.

Because Blancco Drive Eraser’s Common Criteria certification satisfies regulatory criteria for use by the Indian government, the customer can confidently expand its use, including for cloud, on-prem, and hybrid environments. Each secure erasure is documented using tamper-proof certificates that provide granular assurances of data destruction, for use both internally and for audit purposes. Blancco’s global partner network provides local support in Delhi where it’s needed, to help optimize the solution’s use in production.

This implementation provides a pattern that other government agencies can emulate to enable secure data erasure programs of their own, recapturing capital through drive reuse while meeting rigorous operational, cybersecurity, and regulatory requirements—gaining benefits that can’t be had with government hard drive destruction.

About Blancco

Reduce Risk. Increase Efficiency. Be Sustainable. Blancco Technology Group (AIM: BLTG) provides organizations with secure, compliant, and automated solutions that accelerate the transition to the circular economy. Each year, tens of millions of Blancco erasures allow top-tier organizations to protect end-of-life data against unauthorized access, safely redeploy data storage assets, and firmly comply with increased data protection and privacy requirements. Our precise device diagnostics help move used IT assets confidently into the circular economy, enabling enterprises, IT asset disposition (ITAD) vendors and recyclers, and mobile industry stakeholders to operate more sustainably.

Globally approved, recommended and certified by governing and industry bodies around the world, Blancco is the industry standard in data erasure and mobile lifecycle solutions. With 35+ patented or patent-pending ideas, we continue to grow the number of innovative solutions global companies can rely on to accelerate operations, secure their data, and grow their businesses. Read more about us at blancco.com.